CVE-2019-13103 : A crafted self-referential DOS partition table will cause all Das U-Boot version

A crafted self-referential DOS partition table will cause all Das U-Boot versions through 2019.07-rc4 to infinitely recurse, causing the stack to grow infinitely and eventually either crash or overwrite other data.

Published 2019-07-29 15:15:12

Updated 2020-08-24 17:37:01

Source MITRE

View at NVD, CVE.org

Vulnerability category: Denial of service

Products affected by CVE-2019-13103

Denx » U-boot
Versions before (<) 2019.04
cpe:2.3:a:denx:u-boot:*:*:*:*:*:*:*:*
Matching versions
Denx » U-boot » Version: 2019.07 Update RC1
cpe:2.3:a:denx:u-boot:2019.07:rc1:*:*:*:*:*:*
Matching versions
Denx » U-boot » Version: 2019.07 Update RC4
cpe:2.3:a:denx:u-boot:2019.07:rc4:*:*:*:*:*:*
Matching versions
Denx » U-boot » Version: 2019.07 Update RC2
cpe:2.3:a:denx:u-boot:2019.07:rc2:*:*:*:*:*:*
Matching versions
Denx » U-boot » Version: 2019.07 Update RC3
cpe:2.3:a:denx:u-boot:2019.07:rc3:*:*:*:*:*:*
Matching versions
Denx » U-boot » Version: 2019.04 Update RC3
cpe:2.3:a:denx:u-boot:2019.04:rc3:*:*:*:*:*:*
Matching versions
Denx » U-boot » Version: 2019.04 Update RC4
cpe:2.3:a:denx:u-boot:2019.04:rc4:*:*:*:*:*:*
Matching versions
Denx » U-boot » Version: 2019.04
cpe:2.3:a:denx:u-boot:2019.04:-:*:*:*:*:*:*
Matching versions
Denx » U-boot » Version: 2019.04 Update RC2
cpe:2.3:a:denx:u-boot:2019.04:rc2:*:*:*:*:*:*
Matching versions
Denx » U-boot » Version: 2019.04 Update RC1
cpe:2.3:a:denx:u-boot:2019.04:rc1:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2019-13103

EPSS FAQ

0.07%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 31 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2019-13103

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
3.6	LOW	AV:L/AC:L/Au:N/C:N/I:P/A:P	3.9	4.9	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: Partial
7.1	HIGH	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H	1.8	5.2	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: None Integrity: High Availability: High

CWE ids for CVE-2019-13103

CWE-674 Uncontrolled Recursion

The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2019-13103

https://gist.github.com/deephooloovoo/d91b81a1674b4750e662dfae93804d75

Description of CVE-2019-13103 through CVE-2019-13106 · GitHub
Third Party Advisory

CVEs referencing this url
https://cert-portal.siemens.com/productcert/pdf/ssa-618620.pdf

Third Party Advisory

CVEs referencing this url
https://lists.denx.de/pipermail/u-boot/2019-July/375512.html

[U-Boot] [PATCH 1/5] CVE-2019-13103: disk: stop infinite recursion in DOS Partitions
Patch;Third Party Advisory
https://github.com/u-boot/u-boot/commits/master

Commits · u-boot/u-boot · GitHub
Patch;Third Party Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2019-13103

Products affected by CVE-2019-13103

Exploit prediction scoring system (EPSS) score for CVE-2019-13103

CVSS scores for CVE-2019-13103

CWE ids for CVE-2019-13103

References for CVE-2019-13103